mirror of
https://github.com/github/codeql.git
synced 2026-04-23 15:55:18 +02:00
Python: filter more sinks in stdlib
Rename variable to reflect larger scope We had test results inside `os.py`, I suppose we have found a little extra flow.
This commit is contained in:
@@ -71,11 +71,11 @@ module PathInjection {
|
||||
// ```
|
||||
//
|
||||
// The same approach is used in the command injection query.
|
||||
not exists(Module pathlib |
|
||||
pathlib.getName() = "pathlib" and
|
||||
this.getScope().getEnclosingModule() = pathlib and
|
||||
// do allow this call if we're analyzing pathlib.py as part of CPython though
|
||||
not exists(pathlib.getFile().getRelativePath())
|
||||
not exists(Module inStdlib |
|
||||
inStdlib.getName() in ["pathlib", "os"] and
|
||||
this.getScope().getEnclosingModule() = inStdlib and
|
||||
// do allow this call if we're analyzing, say, pathlib.py as part of CPython though
|
||||
not exists(inStdlib.getFile().getRelativePath())
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user